SQL: OIDC and access management#580
Conversation
✅ Deploy Preview for rp-cloud ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
kbatuigas
force-pushed
the
DOC-1999-document-feature-oxla-oidc-authn-support
branch
from
d22990c to
66401a7
Compare
kbatuigas
force-pushed
the
DOC-1999-document-feature-oxla-oidc-authn-support
branch
from
243440f to
da74bd4
Compare
| [source,bash] | ||
| ---- | ||
| PGPASSWORD="$BEARER_TOKEN" \ | ||
| psql "host=<sql-host> port=<sql-port> dbname=oxla user=ignored options='auth_method=bearer' sslmode=require" |
There was a problem hiding this comment.
missing -c. 'auth_method=bearer' should be '-c auth_method=bearer'
| [source,bash] | ||
| ---- | ||
| PGPASSWORD="$CLIENT_SECRET" \ | ||
| psql "host=<sql-host> port=<sql-port> dbname=oxla user=<client-id> options='auth_method=client_secret' sslmode=require" |
There was a problem hiding this comment.
'auth_method=client_secret' should be '-c auth_method=client_secret'
| Two distinct cluster settings affect TLS for OIDC: | ||
|
|
||
| * The cluster's SSL mode controls TLS on the `psql` connection to Redpanda SQL itself. To reject OIDC connections that aren't using TLS, configure the cluster to reject all non-TLS connections. See xref:security:authorization/gbac/gbac_dp.adoc[]. | ||
| * `oidc.require_tls` (default `true`) controls whether Redpanda SQL uses HTTPS when contacting the identity provider: the OIDC discovery document URL, the JWKS endpoint, and the token endpoint for the client-credentials flow. This setting does not gate TLS on the client's `psql` connection. |
There was a problem hiding this comment.
We don't expose oidc.require_tls to customers. We should remove the bullet.
|
|
||
| == Authentication | ||
|
|
||
| Redpanda Cloud preconfigures the SQL engine's OIDC settings when SQL is enabled on the cluster, so you do not need to configure an external identity provider for the SQL engine. The engine validates bearer tokens minted by Redpanda Cloud, regardless of whether you sign in to Redpanda Cloud with email and password or SSO. |
There was a problem hiding this comment.
For SME: please confirm if this is correct and relevant
2 participants
Description
This pull request introduces comprehensive documentation for Redpanda SQL's user and access management features, including new reference pages for user lifecycle statements and privilege management, as well as a guide for connecting with OpenID Connect (OIDC). It also updates the navigation to surface these new topics and ensure users can easily find information about authentication and authorization.
New user and access management documentation:
CREATE USER,ALTER USER, andDROP USERSQL statements, detailing syntax, usage, and examples for managing Redpanda SQL users. [1] [2] [3]GRANTandREVOKESQL statements, covering privilege assignment and removal on various database objects, including external sources and schemas. [1] [2]OIDC authentication documentation:
connect-with-oidc.adoc, describing how to authenticate to Redpanda SQL using OIDC bearer tokens or client credentials, with step-by-step instructions and code examples for multiple clients.Navigation and discoverability improvements:
nav.adocto include links to the new OIDC connection guide, user management, and privilege management topics, making these features easier to find in the documentation. [1] [2]Resolves https://github.com/redpanda-data/documentation-private/issues/
Review deadline: 21 May
Page previews
Redpanda SQL > Connect to RP SQL > Connect to RP SQL with OIDC
Redpanda SQL > Manage RP SQL > Manage Access
Reference > Redpanda SQL Reference > Statements > CREATE USER
Reference > Redpanda SQL Reference > Statements > ALTER USER
Reference > Redpanda SQL Reference > Statements > DROP USER
Reference > Redpanda SQL Reference > Statements > GRANT
Reference > Redpanda SQL Reference > Statements > REVOKE
Checks